CVE-2019-10925
mediumPriorität · verfolgen · 29EPSS 0.022 · 83. PerzentilEURUUSEPSS · bewertet 2026-10-28
A vulnerability has been identified in SIMATIC MV400 family (All Versions < V7.0.6). An authenticated attacker could escalate privileges by sending specially crafted requests to the integrated webserver. The security vulnerability can be exploited by an attacker with network access to the device. Valid user credentials, but no user interaction are required. Successful exploitation compromises integrity and availability of the device. At the time of advisory publication no public exploitation of this security vulnerability was known.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- BehobenSIMATIC MV400 familycisa_csaf_ot
Update to V7.0.6 https://support.industry.siemens.com/cs/ww/en/view/109793481/
- MitigationSIMATIC MV400 familycisa_csaf_ot
By setting the DISA bit, changes to the project by logged-in users can be prevented. Please refer to the Operating Instructions for more details: https://support.industry.siemens.com/cs/ww/en/view/84553392
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 5.5–7.1
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (7)
Betroffene Produkte und Versionsbereiche.
- siemens simatic mv420 firmwarealle VersionennvdUScpe:2.3:o:siemens:simatic_mv420_firmware:*:*:*:*:*:*:*:*
- siemens simatic mv440 firmwarealle VersionennvdUScpe:2.3:o:siemens:simatic_mv440_firmware:*:*:*:*:*:*:*:*
Advisories (1)
Hersteller- und Ökosystem-Meldungen dazu.
- ICSA-19-162-02Siemens SIMATIC Ident MV440 Family (Update A)2019-06-11icsa · cisa_csaf_otUS
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.
auch bekannt als (4)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (12)
Externe Belege — Patches, Meldungen, Analysen.
- http://www.siemens.com/cnnvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-816980.pdfcnnvd
- https://ics-cert.us-cert.gov/advisories/ICSA-19-162-02cnnvd
- https://us-cert.cisa.gov/ics/advisories/ICSA-19-162-02cnnvd
- https://vigilance.fr/vulnerability/SIMATIC-Ident-information-disclosure-via-Web-Session-29519cnnvd
- https://www.securityfocus.com/bid/108725cnnvd
- http://www.securityfocus.com/bid/108725enisa_euvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-816980.pdfenisa_euvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan